Subprocessors
Last updated September 15, 2026
Attune uses the following third-party providers to run the service. Each one may process personal data on our behalf, and each is bound by a contract that restricts it to acting on our instructions. This list is incorporated into our Data Processing Addendum.
Current subprocessors
| Provider | What it does for Attune | Data it may process | Location |
|---|---|---|---|
| Railway | Application hosting and the Postgres database | All data stored by the app, including brand account data and, in direct-send mode, customer contact details | United States (Virginia) |
| Anthropic | Model inference for analysing product content and drafting messages | Product listings, guides, brand guidelines, and public reviews and discussion of the product. No customer names, contact details, or order records | United States |
| Firecrawl | Reading product web pages that do not load with a plain request | The web addresses Attune reads and the public page content returned | United States |
| Resend | Transactional email (sign-in codes, invitations, billing notices, and, in direct-send mode, customer emails) | Email addresses and message content | United States |
| Stripe | Payments and invoicing | Brand billing details and payment method | United States |
| Vercel | Hosting for the marketing site | Website visitor request data | United States |
| PostHog | Analytics for the marketing website | Pages visited and actions taken, browser and device type, and approximate location derived from IP address | United States |
| Google Workspace | Internal email and documents | Support correspondence with brand users | United States |
Providers you connect yourself
If you connect your own email or SMS provider (for example Klaviyo, Attentive, or PostScript), that provider processes your customers' data under your own agreement with them, not as our subprocessor. Attune sends it a pseudonymous customer identifier and rendered message content, and the provider resolves and delivers.
How we notify you of changes
When we add a subprocessor that will process your customers' personal data, we will email your account's admins at least 30 days before it begins processing. The email will name the provider, what it will do, and where it operates. If you have a reasonable data-protection objection, the process in section 6 of the DPA applies. Removing a subprocessor, or a change that does not involve your customers' data, is reflected on this page without separate notice.
History
| Date | Change |
|---|---|
| September 15, 2026 | Initial list published |